GAMP 5 - Good Automated Manufacturing Practice D8: Appendix D8 Agile Software Development

Agile approaches, identified by regulators as foundational for modern technology, are well suited to GxP regulated systems when applied by trained practitioners with appropriate tools, and the guide uses standard Agile processes rather than superimposing linear activities. Using Scrum as the reference, a product owner collects requirements into a backlog of epics and user stories, a cross-functional team refines, develops and tests a subset in time-boxed sprints of two to four weeks, a sprint review and retrospective evaluate value and drive improvement, definition of ready, definition of done and a minimum viable product define when stories are complete and what the initial release needs, regression testing usually automated keeps the system stable, quality roles engage with the product owner, Scrum master and process owner on when they are involved, and accountability for quality and compliance stays with the regulated company; Agile artifacts are not force-fitted to traditional documents, and the completed epics and stories held in tools with audit trail, version and history are the record of delivered functionality. A discovery mindset replaces certainty, with continuous rather than start-and-end involvement of business and quality. Tools instead of documents manage the backlog, testing, orchestration, code repositories, binary registries and knowledge, with stage-gated workflows, reports as baselines and integrated defect management; these tools need risk assessment, adequacy assessment by experts, trained users and controls so that results held in them are trustworthy, complete and available. Backlog refinement and sprint planning are the governance and approval steps, approval does not require a regulated electronic signature except for software as a medical device or embedded device software, and immutable change logs record who did what. DevOps combines development and operations with continuous integration and deployment, adds controls such as starting no development until a story has been accepted, code review and automated testing in the pipeline and constant product owner engagement, still requires risk assessment for higher-risk GxP changes, and needs the team to own compliance. Quality is built in by writing stories with the attributes of good requirements covering data, interfaces, environment, performance, availability, regulatory needs, maintenance, migration and security, checking them against INVEST and definition of ready, identifying GxP functional and nonfunctional requirements and including them in the minimum viable product, leveraging supplier expertise, keeping acceptance criteria high level within the story, testing within every sprint so the product is potentially shippable, combining exploratory testing, automation and regression, using walk-throughs, minimizing final acceptance testing, managing test records in tools and adhering to the Agile ceremonies.